From: Michael Tremer Date: Fri, 11 Jun 2021 16:15:37 +0000 (+0000) Subject: ipsec-policy: Do no create DROP rules for on-demand mode X-Git-Url: http://git.ipfire.org/?p=people%2Fpmueller%2Fipfire-2.x.git;a=commitdiff_plain;h=053a582d3a68456f861d4e7ab3529163ee84ec47 ipsec-policy: Do no create DROP rules for on-demand mode This is not necessary and gets in the way if users have SNAT rules or other things that make the check be in the wrong place. Signed-off-by: Michael Tremer --- diff --git a/config/firewall/ipsec-policy b/config/firewall/ipsec-policy index 1ad4de6501..334e2d9bbd 100644 --- a/config/firewall/ipsec-policy +++ b/config/firewall/ipsec-policy @@ -34,6 +34,11 @@ block_subnet() { local subnet="${1}" local action="${2}" + # Nothing to be done if no action is requested + if [ "${action}" = "none" ]; then + return 0 + fi + # Don't block a wildcard subnet if [ "${subnet}" = "0.0.0.0/0" ] || [ "${subnet}" = "0.0.0.0/0.0.0.0" ]; then return 0 @@ -108,7 +113,7 @@ install_policy() { case "${route}" in route) - action="drop" + action="none" ;; *) action="reject" diff --git a/config/rootfiles/core/158/filelists/files b/config/rootfiles/core/158/filelists/files index e7a6a30739..e39449614e 100644 --- a/config/rootfiles/core/158/filelists/files +++ b/config/rootfiles/core/158/filelists/files @@ -8,6 +8,7 @@ srv/web/ipfire/cgi-bin/pakfire.cgi srv/web/ipfire/cgi-bin/traffic.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi srv/web/ipfire/html/images/apple.png +usr/lib/firewall/ipsec-policy var/ipfire/backup/bin/backup.pl var/ipfire/countries.pl var/ipfire/general-functions.pl